Discovery Configuration
About 15% of the CIS-SM exam — see all 6 domains.
Service Mapping rides on the same infrastructure as Discovery, so a CIS-SM candidate must know the Discovery plumbing.
MID Server
The MID Server (Management, Instrumentation, and Discovery) is the Java application, installed inside the customer network, that executes all probes, patterns, and commands on the instance's behalf and returns results to the instance. For Service Mapping you must:
- Configure MID Servers (often in clusters for capacity and high availability) with line-of-sight to the targets being mapped.
- Confirm the MID Server has the capabilities and applications assigned for the technologies it will discover.
- Know that Service Mapping reads specific MID Server parameters/properties during discovery and mapping; defaults should not be changed unless troubleshooting.
Credentials
Discovery and top-down (pattern-based) mapping require credentials stored in the instance credential store (SSH/SNMP for hosts, Windows credentials via PowerShell/WMI, plus application and cloud credentials). Before mapping, verify that every host and application credential needed along a service's dependency chain is present; missing credentials are a leading cause of stalled maps. Tag-based mapping is the exception: it builds the service from CI tags and needs no credentials.
Verifying readiness
Use the built-in "verify Service Mapping is set up properly" check before mapping: it confirms MID Servers are configured to discover application services (mandatory) and checks whether host and application credentials are in place (optional checks). This readiness check is a recurring exam theme; know that it exists and what it validates.
Patterns are shared
The same application patterns from the Discovery and Service Mapping Patterns app drive both horizontal Discovery (CI attributes) and top-down Service Mapping (connections); infrastructure patterns are used only by Discovery. Keep them installed and current from the Store.
Fast-recall: Domain 3
- MID Server executes probes/patterns/commands inside the network; deploy in clusters with line-of-sight.
- Assign correct capabilities/applications; respect default MID Server parameters unless troubleshooting.
- Credentials (SSH/SNMP/Windows/app/cloud) must cover the whole dependency chain.
- Run the readiness verification before mapping (checks MID Servers + credentials).
- Discovery and Service Mapping share the same application patterns (infrastructure patterns are Discovery only).
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
What is the primary function of a Discovery Schedule?
- A. To set the Order in which Discovery tries each credential against the devices in its ranges
- B. To decide which identification and exploration probes run once a device has been classified
- C. To define when and what (IP ranges or CIs) Discovery runs against using a MID Server ✓
- D. To hold the identification rules that IRE applies when it matches discovered devices to CIs
Why: A Discovery schedule defines when Discovery runs and what it targets (IP ranges or specific CIs), and which MID Server handles the work. Credential order is set by the Order value on each credential record, not by the schedule. Choosing identification and exploration probes after classification is the job of classifiers. Identification rules belong to IRE and are maintained per CI class in CI Class Manager; a schedule does not store them.
Which Discovery phases determine whether a device is alive and what type it is before deeper probing?
- A. Classification and then Identification
- B. Scanning (Shazzam) and then Classification ✓
- C. Identification and then Exploration
- D. Scanning (Shazzam) and then Exploration
Why: Discovery first scans with the Shazzam probe to find which devices are alive and which ports respond, then classifies the device to learn its type. Classification and then identification skips the scan that proves the device is alive, and identification matches a device to a CI rather than detecting it. Identification and exploration both come after the device type is known. Scanning followed by exploration leaves out classification, so the device type would never be determined before deeper probing.
What does the Shazzam probe primarily do?
- A. Classifies each device by running the classification probe that its classifier selects
- B. Matches each device to an existing CI in the CMDB by applying IRE identification rules
- C. Performs a port scan across the target IP ranges to detect active services ✓
- D. Collects detailed attributes such as installed software and running processes from hosts
Why: Shazzam is the scanning probe: it port-scans the target IP ranges to find active devices and the services listening on them. Classification is a later phase, and the classification probe is chosen by the port probe that responded, not by a classifier. Matching a device to an existing CI is identification, done through IRE rules. Collecting installed software and running processes is exploration, which happens only after classification and identification.